What it asks for. This control expects networks, systems and applications to be monitored for anomalous behaviour, with appropriate action taken to evaluate potential information security incidents. The purpose is to detect anomalous behaviour and potential incidents early.
In practice. Good practice means establishing a baseline of normal behaviour, collecting relevant logs and telemetry, and using tools such as a SIEM or detection platform to raise alerts on anomalies. Alerts are triaged by people with defined responsibilities and escalated to incident management. Auditors look for monitoring scope, detection rules, alert handling records and evidence of tuning.
Common gaps. Common gaps are monitoring that excludes cloud services, alerts nobody reviews out of hours and detection rules never tuned or tested. Responsibilities between the internal team and a managed security provider are often unclear.